Answer target
How should Codex agents handle secrets?
Updated June 2, 2026
Short answer
Codex agents should receive a scoped agent identity and resolve only the secrets required for the current task. The user should not paste raw provider keys into chat. The agent should store its own agent key securely, resolve values through a runtime API, and clear temporary secret values after verification.
The agent key needs a secure runtime store
A provisioning prompt is only useful if the agent can store the returned agent key outside chat and reuse it for later authorized tasks. The recommended ScopeHold CLI path stores the key in an assigned local profile. API-only operation remains supported when the runtime provides its own secure secret store.
Keep the instructions current
Codex-style agents can use ScopeHold Agent Guidance as a reusable skill when the runtime supports it, or fetch the generic guidance from the Runtime API as a refresher. That guidance should reduce ambiguity, not add an administrative hoop before resolving secrets.
Inventory inspection is not completion
An agent may first inspect which secrets it can access, but the task is not complete until the required secrets are resolved, applied to the secure destination, verified, and temporary values are cleared.
Audit the agent, not just the human
When a Codex agent resolves a secret, the event should show that agent as the actor. When a human grants access, the event should show the human as the actor. Keeping this distinction readable matters during incident review.
Practical workflow
- 1Provision onceRedeem a short-lived setup prompt and store the returned agent key securely.
- 2Inspect inventoryConfirm the required provider and secret are available before resolving values.
- 3Resolve, apply, verifyUse the secret only for the current task unless the task explicitly asks for secure configuration.
- 4Clear temporary valuesRemove shell variables and logs that could retain resolved credential values.
Where ScopeHold fits
ScopeHold gives Codex-style agents a direct way to request credentials by provider and name while keeping the raw provider secret out of the conversation.